toasters

toasters@lists.teaparty.net

1 participants
13523 discussions

RE: CIFS in Workgroup mode
by Muhlestein, Mark 16 Apr '03

16 Apr '03

You have to set the qtree security to mixed or ntfs to use ACLs. Yes, the local user approach is limited. I was just trying to clarify the statement that "no real security is available". Mark -----Original Message----- From: Alan McLachlan [mailto:amclachlan@asi.com.au] Sent: Wednesday, April 16, 2003 4:18 PM To: Muhlestein, Mark; Alan McLachlan; Robert Borowicz; toasters(a)mathworks.com Cc: Dane Knudson Subject: RE: CIFS in Workgroup mode Mark Muhlestein wrote: >Alan wrote: >> One problem is that in workgroup mode NTFS security isn't available. >> In fact, no real security is available... > This isn't quite right. If you are running with ONTAP 6.1.1 or later you > can create up to 96 local users in workgroup mode and use NTFS security > with NTLM authentication. Even without local users you can use > UNIX-style security if you are willing to use /etc/passwd accounts > (which unfortunately implies the use of plaintext passwords over the > wire during CIFS login). > However, it is true that for the very best available CIFS security > (which uses Kerberos authentication) you do have to have the filer > installed in a Win2k domain. Hi Mark, I just tried this on a lab filer here running 6.4.1R1 and in workgroup mode on an NT4.0 Workstation client (as still used by many of our government Novell customers - some are even still using Win98...) the mapped drive still shows up as FAT - no ACL's. I'll look into this further but I don't see how you're going to get ACL's on basic Windows peer-to-peer networking. Win2K local user account ACL's may work with WinXP workstations, but most customers using NetApp for home directories have hundreds or thousands of users. For only 96 or less users you're not going to buy a NetApp primarily for home dirs... (unless you have too much money to play with and believe in overkill, or they are VERY I/O intensive users, i.e. graphic artists, CAD etc :o) ) In any case, the issue here isn't whether you can use fun workarounds to implement some security - you could use hidden shares to obscure user's home dirs from each other but that's not the same as real permissions. And yes you can map to Unix accounts on the filer and use Unix security. But the real issue is how can this be administered from Novell eDirectory as a resource with managed security. Local accounts (whether Unix or post-Ontap 6.1.1 Win2K local accounts) on the filer don't help, the Novell eDirectory server somehow needs to be the primary account management server before most Novell admins will accept the solution. Personally, I wish we didn't have to deal with Novell environments but there are still too many around to ignore it. *sigh* Do you know what the status is WRT LDAP authentication in OnTap? Regards, Alan. **** ASI Solutions Disclaimer **** The material transmitted may contain confidential and/or privileged material and is intended only for the addressee. If you receive this in error, please notify the sender and destroy any copies of the material immediately. ASI will protect your Privacy according to the 10 Privacy Principles outlined under the new Privacy Act, Dec 2001. This email is also subject to copyright. Any use of or reliance upon this material by persons or entities other than the addressee is prohibited. E-mails may be interfered with, may contain computer viruses or other defects. Under no circumstances do we accept liability for any loss or damage which may result from your receipt of this message or any attachments. **** END OF MESSAGE ****

1 0

RE: CIFS in Workgroup mode
by Alan McLachlan 16 Apr '03

16 Apr '03

Mark Muhlestein wrote: >Alan wrote: >> One problem is that in workgroup mode NTFS security isn't available. >> In fact, no real security is available... > This isn't quite right. If you are running with ONTAP 6.1.1 or later you > can create up to 96 local users in workgroup mode and use NTFS security > with NTLM authentication. Even without local users you can use > UNIX-style security if you are willing to use /etc/passwd accounts > (which unfortunately implies the use of plaintext passwords over the > wire during CIFS login). > However, it is true that for the very best available CIFS security > (which uses Kerberos authentication) you do have to have the filer > installed in a Win2k domain. Hi Mark, I just tried this on a lab filer here running 6.4.1R1 and in workgroup mode on an NT4.0 Workstation client (as still used by many of our government Novell customers - some are even still using Win98...) the mapped drive still shows up as FAT - no ACL's. I'll look into this further but I don't see how you're going to get ACL's on basic Windows peer-to-peer networking. Win2K local user account ACL's may work with WinXP workstations, but most customers using NetApp for home directories have hundreds or thousands of users. For only 96 or less users you're not going to buy a NetApp primarily for home dirs... (unless you have too much money to play with and believe in overkill, or they are VERY I/O intensive users, i.e. graphic artists, CAD etc :o) ) In any case, the issue here isn't whether you can use fun workarounds to implement some security - you could use hidden shares to obscure user's home dirs from each other but that's not the same as real permissions. And yes you can map to Unix accounts on the filer and use Unix security. But the real issue is how can this be administered from Novell eDirectory as a resource with managed security. Local accounts (whether Unix or post-Ontap 6.1.1 Win2K local accounts) on the filer don't help, the Novell eDirectory server somehow needs to be the primary account management server before most Novell admins will accept the solution. Personally, I wish we didn't have to deal with Novell environments but there are still too many around to ignore it. *sigh* Do you know what the status is WRT LDAP authentication in OnTap? Regards, Alan. **** ASI Solutions Disclaimer **** The material transmitted may contain confidential and/or privileged material and is intended only for the addressee. If you receive this in error, please notify the sender and destroy any copies of the material immediately. ASI will protect your Privacy according to the 10 Privacy Principles outlined under the new Privacy Act, Dec 2001. This email is also subject to copyright. Any use of or reliance upon this material by persons or entities other than the addressee is prohibited. E-mails may be interfered with, may contain computer viruses or other defects. Under no circumstances do we accept liability for any loss or damage which may result from your receipt of this message or any attachments. **** END OF MESSAGE ****

1 0

Maximum capacity of a netapp
by Art Hebert 16 Apr '03

16 Apr '03

I am trying to find out what limits a netapp f760's maximum storage capacity. The f760 series used to have a max capacity of 1.5TB, but now docs state that its max capacity is now 3TB. What has caused this to change? OS improvements, cpu changes, etc. thanks art

3 2

Filer shelfs on Linux x86
by Ben Rockwood 16 Apr '03

16 Apr '03

Hello Toasters. I've done some testing recently with using NetApp shelfs (FC8/FC9) attached directly to a Linux box. It's worked very well, and I'm happy with the setup. There are some rough points, but the implimentation is pretty straight forward. I had started writting an article on how to do things end-to-end, but somehow half way thru just didn't see the point. Anyway, here are some interesting tidbits to wet the lips of anyone with shelfs sitting unused. Single FC8 shelf with 18G disks: [root@nexus /]# df -h Filesystem Size Used Avail Use% Mounted on /dev/evms/fc8_volume 118G 15M 118G 1% /filer_shelf [benr@nexus benr]$ bonnie++ -d /filer_shelf/ Version 1.03 ------Sequential Output------ --Sequential Input- --Random- -Per Chr- --Block-- -Rewrite- -Per Chr- --Block-- --Seeks-- Machine Size K/sec %CP K/sec %CP K/sec %CP K/sec %CP K/sec %CP /sec %CP nexus.homeste 1256M 5604 81 19477 18 15546 17 6861 98 59964 37 677.7 5 ------Sequential Create------ --------Random Create-------- -Create-- --Read--- -Delete-- -Create-- --Read--- -Delete-- files /sec %CP /sec %CP /sec %CP /sec %CP /sec %CP /sec %CP 16 998 7 +++++ +++ 376 2 422 5 +++++ +++ 401 3 And this is 2 FC9 shelfs with 36G disks: Filesystem Size Used Avail Use% Mounted on /dev/evms/fc9_vol 474G 60M 474G 1% /filer_shelf [benr@nexus benr]$ bonnie++ -d /filer_shelf/ Version 1.03 ------Sequential Output------ --Sequential Input- --Random- -Per Chr- --Block-- -Rewrite- -Per Chr- --Block-- --Seeks-- Machine Size K/sec %CP K/sec %CP K/sec %CP K/sec %CP K/sec %CP /sec %CP nexus.homeste 1256M 5636 82 33744 33 23145 28 6306 93 60607 37 712.0 7 ------Sequential Create------ --------Random Create-------- -Create-- --Read--- -Delete-- -Create-- --Read--- -Delete-- files /sec %CP /sec %CP /sec %CP /sec %CP /sec %CP /sec %CP 16 775 5 +++++ +++ 345 2 326 4 +++++ +++ 358 3 In both cases, the volumes that were build were striped across all avalible disks, using a stwidth of 16k. LVM was used under EVMS control to all volumes. As you can see from the benchmarks, the block read performance was excellent. For the tests I used my standard Linux workstation, a very slow Dell PIII 550Mhz with 512M RAM. JFS was used as the filesystem. The following are some notes for anyone who might wanna try this: a) DO NOT USE THE KERNELS QLOGIC DRIVER. It sucks! And don't think that you can just push the dev count to 255 and get past it, that only works for 3-4 devices. If you use a QLA2100 grab the QLA2200 driver from Qlogic.com, hack the makefile to build you a QLA2100.o module, the code is there but they don't advertise it. b) I tests all this with a custom 2.4.20 kernel, works great, added EVMS patches. c) EVMS rox, much more fun than LVM raw, but takes much longer to set things up due to the abstration layers added d) You'll have to wipe out the 2 partitions on the disk, which fdisk can't do. You'll need to dd over the first 1k to manually wipe the partitioning scheme. e) If your not already using DevFS I highly suggest it before piling shelfs on. If anyone wants more information or benchmarks, mail me directly and I can send my notes over. benr.

1 0

RE: Maximum capacity of a netapp
by Clarke, John L. (CIS) 16 Apr '03

16 Apr '03

The OS was changed to support 3TB. I do not recall exactly what rev, although I think it was at 6.0. FYI John -----Original Message----- From: Stefan Funke [mailto:bundy@arcor-ip.de] Sent: Wednesday, April 16, 2003 4:30 PM To: Art Hebert Cc: toasters(a)mathworks.com Subject: Re: Maximum capacity of a netapp Quoting message received from Art Hebert: > I am trying to find out what limits a netapp f760's maximum storage > capacity. The f760 series used to have a max capacity of 1.5TB, but > now docs state that its max capacity is now 3TB. What has caused this > to change? OS improvements, cpu changes, etc. 3TB in clustered mode I guess?!? -- Stefan Funke, eMail : bundy(a)arcor-ip.de TBD / Zentrale phone : ++49-(0)6196 587-775 Arcor AG & Co. fax : ++49-(0)6196 587-705 Otto-Volger-Strasse 19 PGP KeyID : 0x9BDCA694 65843 Sulzbach, Germany Web : http://www.arcor.de/

1 0

Who to buy additional drives from?
by David L Kindred (Dave) 16 Apr '03

16 Apr '03

I need to add some drives to the DS14 on our F810, but had a couple of questions. Since the Filer has performed so well, I haven't had much need to deal with it, which is good, but it also means I'm not as familiar with it as I'd like. It seems I only have time to learn about the things that break :( I have been able to find answers to the technical questions on NOW, so I don't have to act stupid about those. I do have one non-technical questions left though: When the time comes to buy the drives should I go back to the VAR we bought the system from, or direct to NetApp, or should I consider some other source? We are maintaining NetApp support, so we would need an "approved" vendor, etc. Thanks. -- David L. Kindred <mailto:d.kindred@telesciences.com> Unix Systems & Network Administrator Telesciences, Inc. <http://www.telesciences.com> Support: <http://support.telesciences.com> 2000 Midlantic Drive, Suite 410, Mt. Laurel, NJ 08054 Tel: +1.856.866.1000 ext. 4184 Fax: +1.856.866.0185 ---

1 0

RE: Reassigning low UIDs
by Ben Rockwood 16 Apr '03

16 Apr '03

The generally accepted low bound is 500. Which goes for both UIDs and GIDs. As for re-assigning, sounds like a job for PERL or some expertly crafted "find" commands. You could create an index in a 2-dimensional array (or just a flat file) mapping new to old UID and then just spider the mount points in question. Just make sure you heavily test it prior to unlessing it. benr. -----Original Message----- From: Jim Davis [mailto:jdavis@cs.arizona.edu] Sent: Wed 4/16/2003 10:43 AM To: toasters(a)mathworks.com Cc: Subject: Reassigning low UIDs Our Unix-side password files go back to the days of SunOS 3.x (if not before), so we have some users with UIDs less than 100. Nowadays this causes problems with NFS on, eg, Linux boxes that seem to assume any UID under at least 1000 is fair game for placeholder accounts. After struggling with this for a while it looks like it's time for a wholesale UID reassignment for those users. - what's a "safe" lower bound for UIDs? 1000? 10000? We'd rather not have to do this more than once! - is there some slick way to reassign UIDs en masse on a filer? We could run 'chown -R ...' on the admin host, but is there a better way?

2 1

tmp files
by Steven Boyer 16 Apr '03

16 Apr '03

I use a SRM product to manage our storage and have noticed an abundant amount of Microsoft temp files which start with ~. I know these are created as a backup 'till the file is saved but we have way to many.... any ideas. Thanks Steve

2 1

RE: CIFS in Workgroup mode
by Muhlestein, Mark 16 Apr '03

16 Apr '03

Alan wrote: > One problem is that in workgroup mode NTFS security isn't available. In > fact, no real security is available... This isn't quite right. If you are running with ONTAP 6.1.1 or later you can create up to 96 local users in workgroup mode and use NTFS security with NTLM authentication. Even without local users you can use UNIX-style security if you are willing to use /etc/passwd accounts (which unfortunately implies the use of plaintext passwords over the wire during CIFS login). However, it is true that for the very best available CIFS security (which uses Kerberos authentication) you do have to have the filer installed in a Win2k domain. Mark

1 0

Re: CIFS in Workgroup mode
by Robert Borowicz 16 Apr '03

16 Apr '03

Alan, You hit the nail right on the head as we say here in the States.... We recently met with a Novell SE and he espoused the same things you did. You've been there and done this??? Option 2 gets my vote.... however I've been asked to conduct an experiment with Option 1 in our lab. Yes Option 1 implies that every packet that comes from the Filer is dissassembled on the Novell gateway machine and reassembled outbound in the format defined. (NCP, HTTP, FTP and yes CIFS and NFS!!!) Sigh.... Onward.... At 12:00 PM 4/16/2003 -0500, wrote: >-------- Original Message -------- >Subject: RE: CIFS in Workgroup mode >Date: Wed, 16 Apr 2003 17:17:19 +1000 >From: Alan McLachlan <amclachlan(a)asi.com.au> >To: Robert Borowicz <rbaus(a)swbell.net>, toasters(a)mathworks.com >CC: Dane Knudson <DKnudson(a)asi.com.au> > >Robert, > >One problem is that in workgroup mode NTFS security isn't available. In >fact, no real security is available... > >There appear to be two options to using a filer in a Novell environment: > >1) The "gateway" Novell server approach. This involves using a Novell server >running Novell NFS Services (with lots of CPU and RAM) with a direct >back-to-back link to the filer to act as an I/O path. Clients and >application hosts only see the Novell server, while the filer thinks the >Novell server is a Unix NIS server that also happens to be it's only client >:o). Security is a subset of Novell permissions as available by mapping Unix >permissions. The drawback here is that the Novell server itself will be an >I/O bottleneck. > >2) eDirectory and Windows integration. For this you need a DC, as you have >identified. The Windows DC runs the Novell eDirectory client and the >security is synchronised with Novell Account Manager. All clients that need >to access the filer need to have the CIFS redirector running. Permissions >are mapped by Novell Account Manager. > >An issue with approach 2 is that when passwords are changed by a helpdesk >directly in eDirectory, they may not be synchronised immediately. If anyone >has found a workaround for this please respond. > >regards, > >Alan. > > >-----Original Message----- >From: Robert Borowicz [mailto:rbaus@swbell.net] >Sent: Wednesday, 16 April 2003 6:26 AM >To: toasters(a)mathworks.com >Subject: CIFS in Workgroup mode > > >Does anybody run CIFS shares in workgroup mode? That is not >booted/authenticated with a PDC? > >I have the joy of trying to make my machine work in a Novell environment >and no DC and would love to share ideas with other lucky souls like me.... > >TIA > >-Bob Borowicz > > >**** ASI Solutions Disclaimer **** > The material transmitted may contain confidential and/or privileged >material and is intended only for the addressee. If you receive this in >error, please notify the sender and destroy any copies of the material >immediately. ASI will protect your Privacy according to the 10 Privacy >Principles outlined under the new Privacy Act, Dec 2001. > > This email is also subject to copyright. Any use of or reliance upon this >material by persons or entities other than the addressee is prohibited. > >E-mails may be interfered with, may contain computer viruses or other >defects. Under no circumstances do we accept liability for any loss or >damage which may result from your receipt of this message or any >attachments. >**** END OF MESSAGE **** > >

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

2002

2001

2000

1999

1998

1997

toasters